linux-kernel - Re: [linus:master] [blk] 22465bbac5: BUG:KASAN:slab-use-after-free_in__cpuhp_state_add_instance

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z2Is2Ee8Me8qRPR-@fedora>
Date: Wed, 18 Dec 2024 10:00:56 +0800
From: Ming Lei <ming.lei@...hat.com>
To: kernel test robot <oliver.sang@...el.com>
Cc: oe-lkp@...ts.linux.dev, lkp@...el.com, linux-kernel@...r.kernel.org,
	Jens Axboe <axboe@...nel.dk>,
	Reinette Chatre <reinette.chatre@...el.com>,
	Fenghua Yu <fenghua.yu@...el.com>,
	Peter Newman <peternewman@...gle.com>,
	Babu Moger <babu.moger@....com>, Luck Tony <tony.luck@...el.com>,
	linux-block@...r.kernel.org
Subject: Re: [linus:master] [blk]  22465bbac5:
 BUG:KASAN:slab-use-after-free_in__cpuhp_state_add_instance_cpuslocked

On Tue, Dec 17, 2024 at 10:20:47PM +0800, kernel test robot wrote:
> 
> 
> Hello,
> 
> kernel test robot noticed "BUG:KASAN:slab-use-after-free_in__cpuhp_state_add_instance_cpuslocked" on:
> 
> commit: 22465bbac53c821319089016f268a2437de9b00a ("blk-mq: move cpuhp callback registering out of q->sysfs_lock")
> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
> 
> [test failed on linus/master      231825b2e1ff6ba799c5eaf396d3ab2354e37c6b]
> [test failed on linux-next/master 3e42dc9229c5950e84b1ed705f94ed75ed208228]
> 
> in testcase: blktests
> version: blktests-x86_64-3617edd-1_20241105
> with following parameters:
> 
> 	disk: 1SSD
> 	test: block-group-01
> 
> 
> 
> config: x86_64-rhel-9.4-func
> compiler: gcc-12
> test machine: 4 threads Intel(R) Core(TM) i5-6500 CPU @ 3.20GHz (Skylake) with 32G memory
> 
> (please refer to attached dmesg/kmsg for entire log/backtrace)
> 
> 
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <oliver.sang@...el.com>
> | Closes: https://lore.kernel.org/oe-lkp/202412172217.b906db7c-lkp@intel.com
> 
> 
> [ 232.596698][ T3545] BUG: KASAN: slab-use-after-free in __cpuhp_state_add_instance_cpuslocked (include/linux/list.h:1026 kernel/cpu.c:2446)

Hello,

Thanks for the report!

Unfortunately I can't reproduce it in my test VM by running
'blktests block/030' with:

- two numa nodes
- enable CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION


But just figured out that one freed hctx still may stay in cpuhp cb list, can
you test the following patch?


diff --git a/block/blk-mq.c b/block/blk-mq.c
index 92e8ddf34575..f655b34efffe 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -4421,7 +4421,8 @@ static struct blk_mq_hw_ctx *blk_mq_alloc_and_init_hctx(
 	/* reuse dead hctx first */
 	spin_lock(&q->unused_hctx_lock);
 	list_for_each_entry(tmp, &q->unused_hctx_list, hctx_list) {
-		if (tmp->numa_node == node) {
+		if (tmp->numa_node == node &&
+				hlist_unhashed(&tmp->cpuhp_online)) {
 			hctx = tmp;
 			break;
 		}


thanks,
Ming